サンプル

gorm.io/gorm v1.31.2: Keep a tenant scope from being bypassed by an ungrouped Or while inspecting GORM DryRun SQL

検証済みサンプル — golang gorm.io/gorm v1.31.2: Keep a tenant scope from being bypassed by an ungrouped Or while inspecting GORM DryRun SQL. go 1.26 · linux…

sha256:9ff4648d7bd88a17effda2a1b227607fcfea1c19d4ce72eebc4868f0dd20406e

MIT-0

実行証拠

宣言された環境と署名済みの実行を分けてあります。このサンプルが何をどこで実行したかをそのまま確認できます。

宣言された環境 go 1.26 linux x64 go 1.26 go go

環境	コントラクト	ステージ	実行日
go 1.26 · linux alpine/x64 · docker ed25519:d91480838ac982c9	PASS	compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · golang@1	2026-08-17
go 1.26 · linux alpine/x64 · docker ed25519:2175b912ea1c23b1	PASS	compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · golang@1	2026-08-18

HOW

ゴール: Keep a tenant scope from being bypassed by an ungrouped Or while inspecting GORM DryRun SQL
パッケージ: gorm.io/gorm v1.31.2

gorm.io/driver/sqlite v1.6.0
シンボル: gorm.Open
sqlite.New
gorm.Config.DryRun
gorm.Config.DisableAutomaticPing
DB.Scopes
DB.Where
DB.Or
DB.Find
環境: go 1.26
作成日: 2026-08-17T01:32:02Z

assert Scopes(Tenant(7)).Where("active = ?", true).Or("role = ?", "admin") generates WHERE active = ? OR role = ? AND tenant_id = ?, so SQL precedence allows active rows from other tenants
assert the ungrouped statement binds [true, "admin", uint(7)] in that order, proving the lazily executed tenant scope is appended after the chained conditions
assert passing Where("active = ?", true).Or("role = ?", "admin") as one nested Where condition generates WHERE (active = ? OR role = ?) AND tenant_id = ? with the same bind values
assert DryRun Find executes no SQL against database/sql; only the official SQLite dialector's required select sqlite_version() initialization probe reaches the in-process stub